The Hindu Business Line : On heat-mapping inherent risks!

IF COMPLIANCE with Clause 49 has been clawing at your peace, here is help from PricewaterhouseCoopers (PwC): `Control'. That's the name of the new `tool' to help "speed up the complex internal processes that companies would have to go through to generate timely and appropriate reports as required by the new legislation," the firm announces.

For starters, the revised Clause 49 of Listing Agreement has come into effect from January 1, and it makes significant difference to the corporate governance scenario. After a long delay, companies have been scampering to comply with the requirements, even as the regulator, SEBI (Securities and Exchange Board of India) is keenly watching.

One learns from PwC that the tool, developed using Microsoft technologies, has the capability to create a six-level organisational structure, viz. "holding corporate, business units, subsidiary units, locations, processes, and sub processes."

Design and implementation of `Control' is based on ORCA, which is PwC's methodology comprising `Objectives, Risks, Controls and Alignment'. The global accounting major explains that ORCA's `central thesis' is: "Objective of superior, sustainable growth in shareholder value is inextricably linked to taking Risks to which individuals respond by establishing Controls/Processes and ensuring Alignment of all factors to value."

The tool `captures' risk from various sources and then rates the same `based on impact and likelihood, before factoring in existing control/mitigation measures' to compute the inherent or gross risk scores. It also generates `Inherent Risk Heat Map' for different levels in the organisation, and the map shows on the screen as a colour-coded grid. The tool talks about risk matrix and risk library, all of which would help when taking risk head-on.

PwC has adopted the categorisation of risk types using COSO Framework and added `strategic risk'. But what is COSO? The site www.coso.org, of the Committee of Sponsoring Organizations of the Treadway Commission, explains that COSO was originally formed in 1985 to sponsor the National Commission on Fraudulent Financial Reporting, as an independent private sector initiative.

COSO Framework defines "essential enterprise risk management (ERM) components, discusses key ERM principles and concepts, suggests a common ERM language, and provides clear direction and guidance for enterprise risk management."

The tool on hand, `Control', has three modules, viz. administrative, risk management, and reporting. While the first helps in configuring the tool, the risk management module takes care of the workflow. "Here the process and sub process of the organisation can be mapped for risk management. Risks can be defined at each of the process and sub-process," explains PwC.

For each risk, controls can be defined; and controls can be assessed for design effectiveness and usage effectiveness for each assessment cycle. This module displays three heat maps, i.e., `inherent, untested and tested'. Reports are about: risks not mapped to objectives, overdue action plans, control usage effectiveness, control design effectiveness and assessment completion.

For the cutting edge in compliance!

Softly@TheHindu.co.in

More Stories on : Corporate Governance | Softly | oftly

Article E-Mail :: Comment :: Syndication :: Printer Friendly Page

Stories in this Section
Getting Down Under

Convergence of accounting standards

Major biz and finance developments in 2005

Sukhasya moolam dharmah, dharmasya mulam arthah
Baskets of X
Bull's Eye
Cartoon Corner
On heat-mapping inherent risks!
Number Crunch - 401
Just Do IT
Calculating capital gains and tax on shares sold
How to prevent IPO scams?
Business-a-Verse
Strategic planning can do better than just feel good